Signed URLs

https://upcdn.io/W142hJk/image/uploads/photo.jpg?w=800&exp=1712345678&sig=1.sRta...

// Credentials (from: Bytescale Dashboard > Security > API Keys > Edit > Secure URLs)
const apiKeyId     = "****dk7S";                 // ⬅️️ REPLACE with your API Key ID
const secureUrlKey = "********************AA=="; // ⬅️️ REPLACE with your Secure URL Key

/**
 * Converts a regular Bytescale File URL into a signed URL.
 *
 * @param fileUrl            E.g. "https://upcdn.io/W142hJk/image/example.jpg?w=800&h=600"
 *                           Must be a valid URL (i.e. must already be URL encoded)."
 * @param ttlSeconds         How long (from now) the URL should remain valid (default: 10 minutes).
 * @param ttlIncrementSize   Rounds expiration to this interval to improve CDN caching (default: 60 seconds).
 * @returns                  Signed Bytescale File URL (with the signature in the 'sig' parameter).
 */
async function getSignedUrl(fileUrl, ttlSeconds = 600, ttlIncrementSize = 60) {
  if (!/^(https?:)?\/\//i.test(fileUrl)) {
    throw new Error("Invalid URL: must start with http://, https://, or //");
  }
  if (ttlSeconds < 1 || ttlSeconds > 604800) {
    throw new Error("Invalid TTL: must be between 1 second and 7 days.");
  }
  if (ttlIncrementSize < 1 || ttlIncrementSize > 604800) {
    throw new Error("Invalid TTL increment: must be between 1 second and 7 days.");
  }

  // 1. Create signing key (HMAC SHA-256)
  const signingKeyData = Buffer.from(secureUrlKey, "base64"); // Bytescale URL Security Keys are Base64-encoded and decode to a valid AES key length.
  const signingKey = await crypto.subtle.importKey("raw", signingKeyData, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);

  // 2. Calculate rounded expiration time (the 'exp' parameter is mandatory for signed URLs)
  const now = Math.floor(Date.now() / 1000);
  const expiration = Math.ceil((now + ttlSeconds) / ttlIncrementSize) * ttlIncrementSize;
  const expirationParam = `exp=${expiration}`;
  const delimiter = fileUrl.includes("?") ? "&" : "?";
  const urlWithExpiration = `${fileUrl}${delimiter}${expirationParam}`;

  // 3. Prepare schemeless URL string (Bytescale signs without scheme for portability)
  const schemelessUrl = urlWithExpiration.slice(urlWithExpiration.indexOf("//") + 2);
  const dataToSign = new TextEncoder().encode(schemelessUrl);

  // 4. Create signature (HMAC)
  const signatureBuffer = await crypto.subtle.sign("HMAC", signingKey, dataToSign);
  const signatureBase64Url = Buffer.from(signatureBuffer).toString("base64url");

  // 5. Construct 'sig' parameter (format: version.apiKeyId.signature)
  const sigParam = `sig=1.${apiKeyId}.${signatureBase64Url}`;

  // 6. Return fully signed URL
  return `${urlWithExpiration}&${sigParam}`;
}

// Returns: "https://upcdn.io/W142hJk/image/example.jpg?w=800&h=600&exp=...&sig=..."
console.log(
  await getSignedUrl("https://upcdn.io/W142hJk/image/example.jpg?w=800&h=600")
);